Systems and methods for non-equal boundary security policy application in a network appliance

A method for generating an efficient policy search tree, the method comprising:

• accessing, by a processor, a policy set;
• identifying, by the processor, items in the policy set, wherein each of the items in the policy set is a single boundary of a range to which a respective policy of the policy set is to be applied;
• identifying, by the processor, a division point in a range extending over the policy set that yields a first range including a first number of the items in the policy set and a second range including as second number of the items in the policy set, wherein the first number and the second number are approximately the same number of items;
• and
• generating, by the processor, a non-equal boundary policy set search tree for the policy set, wherein the non-equal boundary policy set search tree includes at least a first node and a second node, wherein the first node is a first subset of the policy set to be applied over the first range, and wherein the second node is a second subset of the policy set to be applied over the second range, wherein said generating includes:
• determining a partition number for the policy set that reduces replication of policies across different leaf nodes in the non-equal boundary policy set search tree;
• and
• performing a binary partition of the policy set at the division point when the partition number for the policy set is equal to a defined value, wherein performing the binary partition of the policy set results the first range being different from the second range and the first node.

A system for selectively applying policies to network traffic, the system comprising:

• a first processing system communicably including a first non-transitory computer readable medium and a second processing system communicably including a second non- transitory computer readable medium;
• wherein the first non-transitory computer readable medium has stored therein instructions that when executed by the first processing system cause the first processing system to:
• access a policy set;
• and
• generate a non-equal boundary policy set search tree for the policy set, wherein the non-equal boundary policy set search tree includes at least a first node and a second node, wherein the first node is a first subset of the policy set to be applied over a first range, wherein the second node is a second subset of the policy set to be applied over a second range, and wherein the first range is not equal to the second range, wherein generation of the non-equal boundary policy set search tree includes:
• identifying items in the policy set in which each of the items in the policy set is a single boundary of a range to which a respective policy of the policy set is to be applied;
• identifying a division point in the range that yields the first range, including a first number of the items in the policy set, and the second range, including a second number of the items in the policy set;
• performing, partitioning of the policy set at the division point that reduces a number of levels of the non-equal boundary policy set search tree by:
• using an even partitioning of the policy set when a partition number for the policy set is larger than a defined value, wherein performing the even partition of the policy set results in changing the first range to equal the second range;
• and
• using a binary partitioning of the policy set when the partition number for the policy set is equal to the defined value;
• and
• wherein the second non-transitory computer readable medium has stored therein instructions that when executed by the second processing system cause the second processing system to:
• receive a network packet;
• search for a leaf node in the non-equal boundary policy set search tree that matches the network packet, wherein the leaf node is associated with at least one policy of the policy set;
• apply the at least one policy of the policy set to the network packet to yield a processed network packet;
• and
• forward the processed network packet.